2026

Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection

Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connec

Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF v

The Dart and Flutter SDKs provide software development kits for the Dart programming language. In versions of the Dart S

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Prior to version 3.30.4, an un

LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveC

Hono is a Web application framework that provides support for any JavaScript runtime. In versions 4.12.0 and 4.12.1, whe

Ethereum Name Service (ENS) is a distributed, open, and extensible naming system based on the Ethereum blockchain. In ve

Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-

The administrative credentials can be extracted through application API responses, mobile application reverse engineerin

RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service

USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service

A vulnerability was identified in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this issue is some unknown f

In Progress® Telerik® UI for AJAX, versions prior to 2026.1.225, an insufficient entropy vulnerability exists in RadAsyn

The `basic-ftp` FTP client library for Node.js contains a path traversal vulnerability (CWE-22) in versions prior to 5.2

zae-limiter is a rate limiting library using the token bucket algorithm. Prior to version 0.10.1, all rate limit buckets

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and inclu

iccDEV provides a set of libraries and tools for working with ICC color management profiles. In versions up to and inclu

A vulnerability was determined in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected by this vulnerability is an unk

A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /

In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk

In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build confi

In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

Missing Authentication for Critical Function vulnerability in ePati Cyber ​​Security Technologies Inc. Antikor Next Gene

A time-of-create-to-time-of-use (TOCTOU) vulnerability lets recently deleted-then-recreated data sources be re-deleted w

In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve

A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption heade

A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encrypti

A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller c

A vulnerability has been identified within Rancher Manager, where using self-signed CA certificates and passing the -ski

A malicious user can manipulate the parameters.pathPattern to create PersistentVolumes in arbitrary locations on the hos

The Disable Admin Notices – Hide Dashboard Notifications plugin for WordPress is vulnerable to Cross-Site Request Forger

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Stored Cross-Site Scripting

The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all ve

The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check

A flaw has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by thi

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up t

The Geo Mashup plugin for WordPress is vulnerable to SQL Injection via the 'sort' parameter in all versions up to, and i

The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including

The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due

A vulnerability was detected in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected

A security vulnerability has been detected in Tenda F453 1.0.0.3. This impacts the function fromSafeEmailFilter of the f

URLs containing percent-encoded slashes (`/` or `\`) can trick wcurl into saving the output file outside of the current

A weakness has been identified in Tenda F453 1.0.0.3. This affects the function fromNatStaticSetting of the file /goform